How do you know the certificate really came from the CA?

Restriction: This topic applies only when the Enterprise Server feature is enabled.

They sign it.

In addition to the data described earlier (the public key, name , etc of the certified entity), a certificate contains the CA's digital signature. As described earlier, this provides proof - in some countries, legal proof - that it came from the CA.